> "It's not possible to do it any other way" is just pseudo-speak for "nobody has invented a better way yet". ... After 30+ years, nobody has thought of something else?

Not really, I think you've hit the nail on the head. There are plenty of pie-in-the-sky proposals that start from an axiom like "we should replace the centralized CAs with a distributed, decentralized system", but so far I haven't heard of anything that is robust enough to credibly improve on the current architecture.

Off the top of my head, the closest things I can think of to what you're asking for are:

- Namecoin (depends on the Bitcoin blockchain, with everything that implies e.g. huge computational overhead, tight coupling to the volatile Bitcoin economy, and potential attacks from mining cartels etc.)

- The PGP web-of-trust (places additional burden on users who have to decide whether many different intermediaries are "trustworthy"; totally impractical for John Q. Public, in my opinion)

- CACert.org (still relies on a centrally trusted certificate issuer, but crowdsources the identity validation stuff)

If you have better ideas, let's hear them!